How Malware Dodges Detection
Detecting malware is a tricky business because it’s whole design is elusive.
One of the main identifiers of advanced malware is its strategic use of evasion to avoid being caught. In addition to defeating signature-based detection products and behavior-based detection tools, there are hundreds of evasion techniques advanced malware uses to avoid detection. In addition, a malware object will typically deploy multiple tactics.
While there are numerous specific tactics to evade detection, according to SonicWALL, here are a few of the main ones:
Stalling Delays
In this instance, the malware remains idle to defeat timer-based recognition. Most virtualized sandboxes can detect if malware calls the OS sleep function, but they can’t spot evasion if the malware performs the delay internally without calling the OS. Full CPU emulations, “bare-metal” detect these behaviors with unrivaled accuracy. This is very effective against a well-known competitor.
Action-Required Delays
This tactic delays malicious activity pending a specific user action (e.g., mouse click, open or close a file or app). Most virtualized sandboxes will not detect malware waiting on user action.
Intelligent Suspension of Malware
Unlike simple stalling techniques, this category includes sophisticated evasion techniques that discover the presence of a sandbox and suspend malicious actions to avoid detection. Malware waits until it has completed penetration of the host or machine before injecting, modifying or downloading code; decrypting files; moving laterally across network; or connecting to C2 servers.
Fragmentation
This tactic splits malware into fragments, which only execute when reassembled by the targeted system. As virtualized sandboxes typically evaluate fragments separately, each fragment appears harmless, thus evading detection.
Return-Oriented Programming (ROP)
An ROP evasion tactic modifies the stack (memory addresses of code to be executed next), thus injecting functionality without altering the actual code. ROP evasions delegate the execution of its malicious code to other programs, instead of the malware program, thereby hiding it from conventional detection.
Rootkits
A rootkit is an application (or set of applications) that hides malicious code in the lower OS layers. Most virtualized sandboxes do not monitor what an OS does with calls from applications, so the malicious actions performed by a rootkit will generally go undetected.
Because of the increased focus on developing evasion tactics for malware, organizations should apply a multi-engine approach to analyzing suspicious code, especially to find and stop ransomware and credential theft.
If you need assistance with a robust cybersecurity solution, give EnhnacedTECH a call at 714-970-9330 or contact us at [email protected]
Which Employee Will Most Likely Expose Your Business to Risk?
Samantha Keller
Latest posts by Samantha Keller (see all)
- How does AI contribute to “Deepfakes” and what are they? - July 5, 2019
- Are You Flirting With IT Disaster? - June 26, 2019
- The Future of SaaS - June 17, 2019
